Cloudflare Turnstile requiring fingerprintable WebGL

Re:Cloudflare Turnstile requiring fingerprintable WebGL by CodeBytes on Sunday May 31, 2026 @10:52PM (#48352120)

The bot I had was using unique IPs for each request. Some were from cloud providers but most were just random residential ISPs. I couldn't see any obvious connections so rate limiting would've had to be a global rate limit.

Similar to the one SQLite had: https://www2.sqlite.org/forum/forumpost/7d3eb059f81ff694?t=h

Each IP only makes ~1 request though so easy to detect after the fact.

I guess they will run out of IPs at some point so maybe if I had logged each one forever and shown a challenge only to them, it would have fixed it eventually. Just depends how big their pool of IPs is.

[ Parent | on HN ]

Re:Cloudflare Turnstile requiring fingerprintable WebGL by redox99 on Monday June 01, 2026 @03:12AM (#48353546)

You were getting 1k rps, and each request was from an unique IP? So after an hour you got hit by 3.6M different IPs? And all from uncorrelated /16s? That seems hard to believe. Not that I don't believe you, it's just hard for me to grasp that whoever was scraping you had such a large and distributed swarm.

[ Parent | on HN ]

Re:Cloudflare Turnstile requiring fingerprintable WebGL by tardedmeme on Monday June 01, 2026 @06:26AM (#48354917)

This is called rotating residential proxy service. You can buy it off grey market sites that are probably getting it from botnet operators. It costs about $2-$5 per GB.

[ Parent | on HN ]

Re:Cloudflare Turnstile requiring fingerprintable WebGL by redox99 on Monday June 01, 2026 @01:25PM (#48359898)

Interesting, that definitely seems to be it.

[ Parent | on HN ]